Provide service accounts tokens to extensions #9618

stephen-crawford · 2023-08-29T14:11:55Z

Description

This PR implements service account issuance and passing for extensions. This change adds a new transport action which passes the extension a string representation of its service account auth token. This token is created by the TokenManager interface implementation. The token is expected to be an encoded basic auth credential string which can be used by the extension to interact with its own system index.

As part of this change, the ExtensionManager will now take an instance of the IdentityService as part of its construction. This change was made so that the service account token could be generated inside of the class using a call to the token manager. Without passing the IdentityService it was not possible to get the implementation of the TokenManager required to generate the ServiceAccountToken.

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

This issue resolves: opensearch-project/security#3176

Check List

New functionality includes testing.
- All tests pass
New functionality has been documented.
- New functionality has javadoc added
Commits are signed per the DCO using --signoff
Commit changes are listed out in CHANGELOG.md file (See: Changelog)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

github-actions · 2023-08-29T14:16:26Z

Compatibility status:

Checks if related components are compatible with change 8ca2b87

Incompatible components

Incompatible components: [https://github.com/opensearch-project/k-nn.git]

Skipped components

Compatible components

Compatible components: [https://github.com/opensearch-project/security-analytics.git, https://github.com/opensearch-project/security.git, https://github.com/opensearch-project/custom-codecs.git, https://github.com/opensearch-project/opensearch-oci-object-storage.git, https://github.com/opensearch-project/index-management.git, https://github.com/opensearch-project/geospatial.git, https://github.com/opensearch-project/sql.git, https://github.com/opensearch-project/notifications.git, https://github.com/opensearch-project/job-scheduler.git, https://github.com/opensearch-project/observability.git, https://github.com/opensearch-project/neural-search.git, https://github.com/opensearch-project/cross-cluster-replication.git, https://github.com/opensearch-project/alerting.git, https://github.com/opensearch-project/performance-analyzer.git, https://github.com/opensearch-project/anomaly-detection.git, https://github.com/opensearch-project/performance-analyzer-rca.git, https://github.com/opensearch-project/ml-commons.git, https://github.com/opensearch-project/asynchronous-search.git, https://github.com/opensearch-project/common-utils.git, https://github.com/opensearch-project/reporting.git]

github-actions · 2023-08-29T14:18:17Z

Compatibility status:

Checks if related components are compatible with change 3bdc4e4

Incompatible components

Skipped components

Compatible components

peternied

Just minor cleanup, then should be ready to merge - much smaller change good work @scrawfor99

server/src/main/java/org/opensearch/extensions/ExtensionsManager.java

server/src/main/java/org/opensearch/node/Node.java

server/src/main/java/org/opensearch/extensions/ExtensionsManager.java

CHANGELOG.md

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

github-actions · 2023-09-21T14:35:13Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26013/
CommitID: 64b689a
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-09-21T14:47:36Z

Gradle Check (Jenkins) Run Completed with:

RESULT: SUCCESS ✅
URL: https://build.ci.opensearch.org/job/gradle-check/26012/
CommitID: 0415f58

Signed-off-by: Peter Nied <petern@amazon.com>

peternied · 2023-09-21T20:21:28Z

@scrawfor99 Waiting on CI to complete since merge conflicts were resolved

github-actions · 2023-09-21T21:07:45Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26045/
CommitID: 64b689a
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-09-21T21:08:20Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26047/
CommitID: 8ca2b87
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-09-21T23:49:15Z

Gradle Check (Jenkins) Run Completed with:

RESULT: UNSTABLE ❕
TEST FAILURES:

      1 org.opensearch.snapshots.CloneSnapshotIT.testCloneShallowSnapshotIndex
      1 org.opensearch.index.shard.RemoteIndexShardTests.testRepicaCleansUpOldCommitsWhenReceivingNew

URL: https://build.ci.opensearch.org/job/gradle-check/26077/
CommitID: 8ca2b87
Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

github-actions · 2023-09-22T02:45:35Z

Gradle Check (Jenkins) Run Completed with:

RESULT: UNSTABLE ❕
TEST FAILURES:

      1 org.opensearch.action.admin.cluster.node.tasks.ResourceAwareTasksTests.testTaskResourceTrackingDuringTaskCancellation

URL: https://build.ci.opensearch.org/job/gradle-check/26083/
CommitID: 8ca2b87
Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

stephen-crawford · 2023-09-22T13:47:56Z

@peternied should be all set :D

peternied · 2023-09-22T14:21:38Z

@scrawfor99 Could you make sure all the flaky test have issues or file new ones, this was a rough go of things

stephen-crawford · 2023-09-22T15:47:37Z

Will do

Provide service accounts tokens to extensions This change adds a new transport action which passes the extension a string representation of its service account auth token. This token is created by the TokenManager interface implementation. The token is expected to be an encoded basic auth credential string which can be used by the extension to interact with its own system index. Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Peter Nied <petern@amazon.com> Co-authored-by: Owais Kazi <owaiskazi19@gmail.com> Co-authored-by: Peter Nied <petern@amazon.com>

Provide service accounts tokens to extensions This change adds a new transport action which passes the extension a string representation of its service account auth token. This token is created by the TokenManager interface implementation. The token is expected to be an encoded basic auth credential string which can be used by the extension to interact with its own system index. Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Peter Nied <petern@amazon.com> Co-authored-by: Owais Kazi <owaiskazi19@gmail.com> Co-authored-by: Peter Nied <petern@amazon.com> Signed-off-by: Ivan Brusic <ivan.brusic@flocksafety.com>

Provide service accounts tokens to extensions This change adds a new transport action which passes the extension a string representation of its service account auth token. This token is created by the TokenManager interface implementation. The token is expected to be an encoded basic auth credential string which can be used by the extension to interact with its own system index. Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Peter Nied <petern@amazon.com> Co-authored-by: Owais Kazi <owaiskazi19@gmail.com> Co-authored-by: Peter Nied <petern@amazon.com> (cherry picked from commit 994e115)

Provide service accounts tokens to extensions This change adds a new transport action which passes the extension a string representation of its service account auth token. This token is created by the TokenManager interface implementation. The token is expected to be an encoded basic auth credential string which can be used by the extension to interact with its own system index. Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Peter Nied <petern@amazon.com> Co-authored-by: Owais Kazi <owaiskazi19@gmail.com> Co-authored-by: Peter Nied <petern@amazon.com>

#11052) * Implement on behalf of token passing for extensions (#8679) * Provide service accounts tokens to extensions (#9618) This change adds a new transport action which passes the extension a string representation of its service account auth token. This token is created by the TokenManager interface implementation. The token is expected to be an encoded basic auth credential string which can be used by the extension to interact with its own system index. * Cherry pick #10614 and #10664 Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Ryan Liang <jiallian@amazon.com> Signed-off-by: Peter Nied <petern@amazon.com> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Co-authored-by: Peter Nied <peternied@hotmail.com> Co-authored-by: Owais Kazi <owaiskazi19@gmail.com> Co-authored-by: Peter Nied <petern@amazon.com>

Provide service accounts tokens to extensions This change adds a new transport action which passes the extension a string representation of its service account auth token. This token is created by the TokenManager interface implementation. The token is expected to be an encoded basic auth credential string which can be used by the extension to interact with its own system index. Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Peter Nied <petern@amazon.com> Co-authored-by: Owais Kazi <owaiskazi19@gmail.com> Co-authored-by: Peter Nied <petern@amazon.com> Signed-off-by: Shivansh Arora <hishiv@amazon.com>

stephen-crawford and others added 2 commits August 29, 2023 09:26

Add transport action

eee8b01

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

Merge branch 'opensearch-project:main' into issueSA

f568e03

stephen-crawford added 2 commits August 29, 2023 10:13

Update changelog

3bdc4e4

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

Update changelog

6b7849f

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

peternied changed the title ~~Implement service account issuance and fetching for extensions~~ Provide service accounts tokens to extensions Sep 20, 2023

peternied reviewed Sep 20, 2023

View reviewed changes

stephen-crawford and others added 2 commits September 21, 2023 10:01

final changes

0415f58

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

Merge branch 'opensearch-project:main' into issueSA

64b689a

stephen-crawford requested a review from peternied September 21, 2023 14:03

Merge branch 'main' into issueSA

8ca2b87

Signed-off-by: Peter Nied <petern@amazon.com>

peternied approved these changes Sep 21, 2023

View reviewed changes

peternied merged commit 994e115 into opensearch-project:main Sep 22, 2023
13 checks passed

peternied deleted the issueSA branch September 22, 2023 14:21

stephen-crawford mentioned this pull request Oct 2, 2023

[2.x] Adds changes related to OnBehalfOf and Service Accounts feature #10258

Closed

6 tasks

RyanL1997 mentioned this pull request Nov 1, 2023

[Backport 2.x] Service accounts and on-behalf-of authentication in 2.x #11052

Merged

8 tasks

RyanL1997 mentioned this pull request Nov 1, 2023

Backport Service Account into 2.x branch opensearch-project/security#3557

Closed

8 tasks

BrewTestBot mentioned this pull request Feb 21, 2024

opensearch 2.12.0 Homebrew/homebrew-core#163463

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Provide service accounts tokens to extensions #9618

Provide service accounts tokens to extensions #9618

stephen-crawford commented Aug 29, 2023 •

edited

Loading

github-actions bot commented Aug 29, 2023 •

edited

Loading

github-actions bot commented Aug 29, 2023

peternied left a comment

github-actions bot commented Sep 21, 2023

github-actions bot commented Sep 21, 2023

peternied commented Sep 21, 2023

github-actions bot commented Sep 21, 2023

github-actions bot commented Sep 21, 2023

github-actions bot commented Sep 21, 2023

github-actions bot commented Sep 22, 2023

stephen-crawford commented Sep 22, 2023

peternied commented Sep 22, 2023

stephen-crawford commented Sep 22, 2023

Provide service accounts tokens to extensions #9618

Provide service accounts tokens to extensions #9618

Conversation

stephen-crawford commented Aug 29, 2023 • edited Loading

Description

Related Issues

Check List

github-actions bot commented Aug 29, 2023 • edited Loading

Compatibility status:

Incompatible components

Skipped components

Compatible components

github-actions bot commented Aug 29, 2023

Compatibility status:

Incompatible components

Skipped components

Compatible components

peternied left a comment

Choose a reason for hiding this comment

github-actions bot commented Sep 21, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 21, 2023

Gradle Check (Jenkins) Run Completed with:

peternied commented Sep 21, 2023

github-actions bot commented Sep 21, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 21, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 21, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 22, 2023

Gradle Check (Jenkins) Run Completed with:

stephen-crawford commented Sep 22, 2023

peternied commented Sep 22, 2023

stephen-crawford commented Sep 22, 2023

stephen-crawford commented Aug 29, 2023 •

edited

Loading

github-actions bot commented Aug 29, 2023 •

edited

Loading